ci: sign console release artifacts with Cosign

[nbmaiti]

Signs each console release binary with keyless Cosign using GitHub Actions OIDC, so users can verify download provenance without trusting any stored secret. The signature bundles (.sig, .pem, .cosign.bundle.json) are published automatically alongside every release.

No secrets need to be provisioned — signing uses the short-lived OIDC token GitHub issues to the workflow at runtime.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.45%. Comparing base (861e864) to head (6e16166).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1171   +/-   ##
=======================================
  Coverage   44.45%   44.45%           
=======================================
  Files         144      144           
  Lines       13732    13732           
=======================================
  Hits         6105     6105           
  Misses       7054     7054           
  Partials      573      573           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds keyless Sigstore/Cosign signing to the Console release pipeline, enabling users to verify the provenance of published release binaries using GitHub Actions OIDC (no long-lived signing secrets).

Changes:

• Added a sign.sh script that signs and (optionally) verifies each release artifact via cosign sign-blob/verify-blob.
• Updated semantic-release configuration to run signing during prepare and upload .sig, .pem, and .cosign.bundle.json files as release assets.
• Updated the release workflow to grant id-token: write and install Cosign, and added .gitattributes to enforce LF for scripts.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sign.sh	Adds Cosign keyless signing + verification for the set of release artifacts.
.releaserc.json	Runs signing during release preparation and publishes signature/bundle assets.
.github/workflows/release.yml	Enables OIDC token issuance for the job and installs Cosign before semantic-release.
.gitattributes	Enforces LF endings for build.sh and sign.sh.